https://community.splunk.com/t5/Monitoring-Splunk/Should-I-Turn-on-Hyperthreading-with-Splunk/m-p/256234#M2464 <P>My Intel processor supports hyperthreading, which should provide more performance. Should I turn on hyperthreading while using Splunk?</P> Thu, 03 Dec 2015 22:09:35 GMT David 2015-12-03T22:09:35Z https://community.splunk.com/t5/Monitoring-Splunk/Should-I-Turn-on-Hyperthreading-with-Splunk/m-p/256234#M2464 <P>My Intel processor supports hyperthreading, which should provide more performance. Should I turn on hyperthreading while using Splunk?</P> Thu, 03 Dec 2015 22:09:35 GMT https://community.splunk.com/t5/Monitoring-Splunk/Should-I-Turn-on-Hyperthreading-with-Splunk/m-p/256234#M2464 David 2015-12-03T22:09:35Z https://community.splunk.com/t5/Monitoring-Splunk/Should-I-Turn-on-Hyperthreading-with-Splunk/m-p/256235#M2465 <P>Yes, definitely! Splunk, like most solutions, enjoys about a 20-30% performance boost when you turn on Hyperthreading. It's important to note, though, that this is not a doubling of performance. </P> <P>Note that if you run top (or Windows Task Manager, or etc.), it will appear that you have twice as many CPU cores as you actually do. With the default simultaneous search settings, that means if you have a 16 core system and you turn on HT, you will go from running 22 searches (6 + 16) to 38 searches (6 + 16*2). For understanding how that should impact your overall capacity planning, please check the <A href="http://docs.splunk.com/Documentation/Splunk/6.3.1/Capacity/Accommodatemanysimultaneoussearches">Capacity Planning documentation</A>. As always, you should monitor the performance of your systems and searches using tools like the Distributed Management Console, Search Activity app, etc. </P> Thu, 03 Dec 2015 22:17:35 GMT https://community.splunk.com/t5/Monitoring-Splunk/Should-I-Turn-on-Hyperthreading-with-Splunk/m-p/256235#M2465 David 2015-12-03T22:17:35Z https://community.splunk.com/t5/Monitoring-Splunk/Should-I-Turn-on-Hyperthreading-with-Splunk/m-p/256236#M2466 <P>So a follow-up to this would be (especially given cloud vendors moving to tout vCPUs (i.e. hyperthreaded)) are there any other auto-tunables (or autotuned by default) that would cause performance problems because a 32 vCPU VM only has 20 cores worth of performance but reports 32 cores? What about for indexers?</P> Tue, 26 Mar 2019 00:27:23 GMT https://community.splunk.com/t5/Monitoring-Splunk/Should-I-Turn-on-Hyperthreading-with-Splunk/m-p/256236#M2466 AGLbwa 2019-03-26T00:27:23Z https://community.splunk.com/t5/Monitoring-Splunk/Should-I-Turn-on-Hyperthreading-with-Splunk/m-p/558337#M5116 <P>Just to link the topics...</P><P>If you are running Splunk Enterprise in an environment where the difference between physical CPUs and virtual CPUs/threads is visible for SplunkD (e.g. bare metal, AWS, GCP, etc) you will see a higher "virtual" number which will be taken into account by the Splunk-internal engines.&nbsp;</P><P>See limits.conf.&nbsp;</P><P>If you are in a VMware environment and you see physical CPU=virtual CPU, you need to double the vCPU count in your VMware instance settings&nbsp; to get the same performance because otherwise SplunkD will use less resources.&nbsp;</P><P><A href="https://community.splunk.com/t5/Archive/How-does-Splunk-handle-Hyperthreading-in-a-VMware-environment/m-p/424582/highlight/true#M75311" target="_blank">https://community.splunk.com/t5/Archive/How-does-Splunk-handle-Hyperthreading-in-a-VMware-environment/m-p/424582/highlight/true#M75311</A></P> Mon, 05 Jul 2021 19:11:30 GMT https://community.splunk.com/t5/Monitoring-Splunk/Should-I-Turn-on-Hyperthreading-with-Splunk/m-p/558337#M5116 hsesterhenn_spl 2021-07-05T19:11:30Z